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PACKET ROUTING DEVICE 




BACKGROUND OF THE INVENTION 



5 



[0001] 



The invention relates to a packet routing 



device and particularly to a technology of routing a 
packet in communications between Virtual Private 
Networks (VPNs) through a search process by each packet 
management (PM) unit on a receiving side and on a 

10 transmitting side. 

[0002] Hitherto, a router system is, as shown in 

FIG. 7A, constructed of a switching unit (SW) and a 
plurality of PMs (which might be called "blades" to the 
SW) connected to the SW. The SW has a control 

15 processor and a switching function. Further, each of 
the PMs has a termination processing function of a 
Layer 2 (L2) and a routing function of a Layer 3 (L3) . 
[Q003] In recent years, the router system has a 

function of performing routing related to VPN 

2 0 communications between a user terminal and a 

predetermined Internet Service Provider (ISP) . Further, 
the router system has a function of accommodating a 
plurality of VPNs and actualizing communications . 
between VPNs. Moreover, a certain router system 

25 functions as a device which is called Broadband Remote 
Access Server (BRAS) that is placed at a edge of core 
network (e.g. Internet Protocol (IP) network) and 
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connects each user terminal accommodated directly at an 
access side to a variety of broadband services provided 
on a core network side (an up-link side) . The BRAS 
performs, in order to provide the broadband services 
5 provided by a variety of servers (e.g. contents server) 
to users belonging to one of VPNs, packet routing 
between a VPN of an user and another VPN of a target 
server of the user. Therefore, a. function of 
actualizing the communications between the VPNs is 

10 substantially indispensable for the BRAS. 

[0004] One of router system actualizes the packet 

routing related to the VPN communications by executing 
a search process in each PM on a receiving side and a 
transmitting side of packets. Each PM functions as a 

15 receiving-side PM when receives a packet received at a 
receipt port and functions as a transmitting-side PM 
when receives a packet from other PM as the receiving- 
side PM via the SW. Each PM as the receiving-side PM 
executes a search process for the transmitting-side PM 

2 0 corresponding to a destination of the packet from the 
receipt port, and forwards the packet to the 
transmitting-side PM searched for. On the other hand, 
each PM as the transmitting-side PM executes a search 
process for searching a transmission port of the packet, 

25 and forwards the packet to the transmission port 
searched for. 

[0005] The BRAS router system, each PM executing 
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the search process, as shown in FIGs. 7B and 7C, has 
two routing tables which respectively includes entries 
for searching for network addresses and entries for 
searching for the terminals per PM. The entries for 
5 searching for the terminals are used for routing each 
packet of which a destination is a user's terminal. 
The routing table of each PM retains the entries of the 
same contents. Each routing table has entries each 
including a VPN identifier (VPN-ID) , an IP destination 

10 address (IPDA) and a prefix. Each PM searches for a 

VPN-ID corresponding to the receipt port of the packet 
(receiving-side VPN-ID) , and a transmitting-side PM and 
a transmission port corresponding to the IPDA of the 
packet and the prefix by use of the routing table. 

15 [0006] The entries in the routing table are 

normally registered in a Content Addressable Memory 
(CAM) device. The number of entries registered in the 
CAM device depends on a capacity of the CAM device. It 
is therefore desirable that the CAM entries be 

20 efficiently registered by an aggregation of the entries, 
and so on . 

[0007] Herein, there were the following problems 

in the prior art. That is, in the search process by 
each PM, the receiving-side VPN-ID is used as a search 
25 key to the routing table. Therefore, when the router 

system transmits to the same egress route (transmission 
port) packets received from the different VPNs (the 
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receiving-side VPN is different) , the same entries for 
the terminals had to be prepared per the receiving-side 
VPN. For example, in FIG. 7A, in case each of an ISP-A 

(VPN-A) and a server C (VPN-C) transmits packets to 
5 each terminal of a terminal group A, entries for the 

terminals corresponding to the VPN-A (self-VPN) and the 
entries for the terminals corresponding to the VPN-C 

(other VPN) had to be registered in the routing table. 
Thus, in the prior art, the overlapped entries for the 
10 terminals had to be registered to the routing table 
each time the number of VPNs that is performed 
communications between the VPNs increases. 

[0008] Further, prior art document information 

related to the invention of the application is given as 
15 follows. 

[0009] Japanese Patent Application Laid-Open 

Publication No . 2002-111723 

SUMMARY OF THE INVENTION 

20 

[0010] One of object of the invention is to 

provide a packet routing device enabling an efficient 
entry registration without registering an overlapped 
entry . 

25 [0011] The invention adopts the following 

architecture for accomplishing the object. 
[0012] The invention is a packet routing device 
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accommodating a plurality of virtual private networks 
(VPNs) , comprising a switch and a plurality of packet 
processing units, wherein each packet processing unit, 
in the case of receiving a packet received at a receipt 
5 port, searches, as a receiving-side packet processing 
unit, for a transmitting-side packet processing unit 
for forwarding this packet to a transmission port from 
a routing table by use of a receiving-side VPN 
identifier of the packet, and forwards the packet to a 

10 packet processing unit corresponding to the 

transmitting-side packet processing unit, and, in the 
case of receiving the packet via the switch from the 
receiving-side packet processing unit, searches, as a 
transmitting-side packet processing unit, for a 

15 transmission port for this packet from the routing 

table by use of a transmitting-side VPN identifier of 
the packet, and forwards the packet to the transmission 
port searched for. 

[0013] According to the invention, the receiving- 

20 side packet processing unit effects the routing search 
by use of the receiving-side VPN identifier, and the 
transmitting-side packet processing unit effects the 
routing search by use of the transmitting-side VPN 
identifier. Namely, the invention has no such bad 
25 effect as to register the overlapped entry in order to 
perform the routing search by use of the receiving-side 
VPN identifier in the receiving-side and transmitting- 
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side packet processing units. Namely, the overlapped 
registration of the entry can be prevented. 
Accordingly, for instance, in the case where the packet 
routing device accommodates the terminal device 
5 belonging to the VPN , it may be sufficient if the 

entries for the terminals are not prepared for every 
receiving-side VPN, and therefore the efficient entry 
registration can be done. 

[0014] A router and a layer-3 switch each having 

10 the switch and the plurality of packet processing units 
can be exemplified as the packet routing devices. 
[0015] It is preferable that the invention be 

constructed so that each of the packet processing units, 
in the case of functioning as the receiving-side packet 

15 processing unit, searches for the corresponding 
transmitting-side packet processing unit and 
transmitting-side VPN identifier from the routing table 
by use of the receiving-side VPN identifier, and 
forwards the thus-searched transmitting-side VPN 

20 identifier to the transmitting-side packet processing 
unit, and, in the case of functioning as the 
transmitting-side packet processing unit, searches for 
the corresponding transmission port from the routing 
table by use of the transmitting-side VPN identifier 

25 from the receiving-side packet processing unit. 

[0016] It is preferable that the packet routing 

device of the invention be constructed so that it 
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further comprises entry registering means for executing 
a process of registering the entry in the routing table 
of each packet processing unit, the entry registering 
means receives a plurality of entries as candidates for 
5 registration with respect to a certain packet 

processing unit, each entry contains the VPN identifier 
as a search key, and packet processing unit identifying 
information and a transmitting-side VPN identifier that 
correspond to that VPN identifier, the entry 

10 registering means executes a process for registering in 
the routing table only such an entry that among the 
plurality of entries as the candidates for registration, 
the packet processing unit identifying information 
contained in the entry indicates the certain packet 

15 processing unit, and that the VPN identifier as the 
search key is the same as the transmitting-side VPN 
identifier. 

[0017] If done in this way, it is possible to 

prevent such a state that the overlapped entry is to be 

20 registered in the routing table. 

[0018] Further, the invention can be also 

specified as a packet routing device disposed between a 
network side and a user side, accommodating a plurality 
of virtual private networks (VPNs) , accommodating a 

25 user terminal belonging to any one of the plurality of 
VPNs, the device comprising a switch and a plurality of 
packet processing units, wherein each packet processing 
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unit, in the case of receiving a packet received at a 
receipt port and addressed to the user terminal, 
searches, as a receiving-side packet processing unit, 
for a transmitting-side packet processing unit and a 
5 transmitting-side VPN identifier that correspond to a 

receiving-side VPN identifier and a destination network 
address of the packet from a routing table, and, in the 
case of receiving the packet and the transmitting-side 
VPN identifier from the receiving-side packet 

10 processing unit via the switch, searches, as a 
transmitting-side packet processing unit, for a 
transmission port corresponding to the transmitting- 
side VPN identifier and to a destination host address 
of the packet from the routing table, and forwards the 

15 packet to the transmission port searched for. 

[0019] Moreover, the invention can be specified as 

a packet processing device provided in a packet routing 
device accommodating a plurality of virtual private 
networks (VPNs) with at least one other packet 

20 processing device, comprising a receiving-side packet 
processing unit, a transmitting-side packet processing 
unit and a routing table, wherein the receiving-side 
packet processing unit receives a packet received at a 
receipt port of the packet routing device and searches 

25 for other packet processing device for forwarding this 
packet to a transmission port from the routing table by 
use of a receiving-side VPN identifier of this packet, 
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and the transmitting-side packet processing unit 
receives a packet forwarded from other packet 
processing device and searches for a transmission port 
of this packet from the routing table by use of a 
5 transmitting-side VPN identifier of this packet. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0020] 

10 FIGs. 1A and IB show a compositions view for 

explaining an embodiment of a packet routing device; 

FIG. 2 shows a compositions view for explaining 
an embodiment of a packet processing unit (packet 
processing device: corresponding to PM) ; 
15 FIG. 3A is a diagram showing a data structure 

example of a table for searching for a receiving-side 
VPN identifier; 

FIG. 3B is a diagram showing a data structure 
example of a routing table for searching for a 
20 transmitting-side packet processing unit and a 
transmitting-side VPN identifier; 

FIG. 4 is a flowchart showing a process by the 
packet processing unit; 

FIG. 5 is a flowchart showing an entry delete 
25 process when registering an entry; 

FIGs. 6A and 6B are an operation explanatory 
diagram of the entry delete process; 
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FIGs. 7A, 7B and 7C are an explanatory view of 
the prior art. 

DESCRIPTION OF THE PREFFERD EMBODIMENT 

5 

[0021] Embodiments of the invention will 

hereinafter be explained with reference to the drawings. 

Compositions of the embodiment are exemplifications, 

and the invention is not limited to the compositions of 
10 the embodiment. 

[0022] Compositions of Packet Routing Device> 

FIGs. 1A and IB are diagrams showing an 

embodiment of a system composition of a packet routing 

device of the invention. In FIG. 1A, a BRAS router 
15 system 1 (which will hereinafter be referred to as a 

"router 1") corresponding to the packet routing device 

of the present invention is shown. 

[0023] The router 1 includes a switch (SW 2) and a 

plurality of packet processing units PMO , PM1 and PM2 

20 (corresponding to a packet processing device, a 
receiving-side packet processing unit and a 
transmitting-side packet processing unit) . The packet 
processing unit PM1 (which will hereinafter be simply 
termed a"PMl") is a PM on an access side (a down-link 

25 side or a user side), and accommodates user's terminals 
in a group A belonging to a VPN-A. In FIG. 1, the PM1 
accommodates, by way of an example, a plurality of 



- 11 - 



terminals having IP addresses "160.0.0.1", "160.0.0.2", 
"160.0.0.3", respectively . 

[0024] Further, the packet processing unit PM2 

(which will hereinafter be simply termed a Tpm2J ) is a 
5 PM on the access side and accommodates user's terminals 
in a group B belonging to a VPN-B . In FIG. 1A, the PM2 
accommodates, by way of an example, a plurality of 
terminals having IP addresses "190.0.0.1", "190.0.0.2", 
"190.0.0.3", respectively . 

10 [0025] Moreover, the packet processing unit PM0 

(which will hereinafter be simply termed a TpmoJ ) is a 
PM on the up-link side (a network side) and is 
connected via a core network (an IP network: not 
illustrated) to an ISP-A (an IP address "160.1.0.1") 

15 belonging to the VPN-A, an ISP-B (an IP address 

"190.1.0.1") belonging to the VPN-B, a server C (an IP 
address "210.0.0.1") belonging to a VPN-C and a server 
D (an IP address "220.0.01") belonging to a VPN-D . 
[0026] The servers C and D are, for instance, 

2 0 content servers. Each terminal in the group A and B is 
able to access the servers C and D and to download data 
from them. . Each of the servers C and D, further, can 
also function as routing servers for routing packets 
respectively between, the ISP-A, each terminal in the 

25 group A, the ISP-B and each terminals in the group B. 
[0027] Thus, the router 1 accommodates the 

plurality of VPNs (VPN-A, VPN-B, VPN-C and VPN-D) and 
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accommodates the user terminals (each terminal in the 
group A anc B) belonging to at least one of the 
plurality of VPNs. Then, the router 1 controls the 
routing and forwarding processes (VPN communications) 
5 of the packets between the group A and the ISP-A and 
between the group B and the ISP-B, and the routing and 
forwarding processes (inter-VPN communications) of the 
packets between the different VPNs. 

Each of the PMO , PM1 and PM3 respectively has two 

10 routing tables as shown in FIG. IB. 

[0028] Composition of each PM> 

FIG. 2 is a diagram showing an. example of 
composition of each PM shown in FIG. 1. Each of the 
PMO - PM2 has the same composition. Each of the PMO - 

15 PM2 functions as a receiving-side PM for receiving the 
packet from outside and as a transmitting-side PM for 
transmitting the packet received from the receiving- 
side. PM to outside. 

[0029] In FIG. 2, the PM includes an L2 processing 

20 unit that terminates a layer 2 (L2), and an L3 

processing unit that performs routing to a layer 3 (L3) . 
The L2 processing unit includes a network processor 
(NP) 11, a search engine (SE) 12, and a CAM 13 and an 
Static Random Access Memory (SRAM) 14 as a search table 
25 of the receiving-side VPN identifying information. 

[0030] The NP 11 analyzes the packet and transfers 

search information obtained by the analysis to the SE 
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12. The SE 12 generates a CAM access key (a search 
key) on the basis of the search information from the NP 
11, and makes a search of the CAM 13 by using the CAM 
access key. The SE 12 receives an address of the SRAM 
5 14 from the CAM 13 as a search result. The SE 12 

accesses the SRAM 14 by use of the SRAM address, and 
receives associative data (desired data) corresponding 
to the SRAM address. The SE 12 transfers the 
associative data to the NP 11. 

10 [0031] In case the PM functions as the receiving- 

side PM, the L2 processing unit searches, from the 
search table, for the corresponding receiving-side VPN 
identifying information (the receiving-side VPN-ID) , 
with a search key being the identifying information (an 

15 ID or a number) of a receipt port at which the packet 
was received, and transfers this receiving-side VPN-ID 
to the L3 processing unit. The receipt port of the 
packet can be identified by the analysis of the packet 
at the NP 11. Note that information other than the 

20 receipt port can be used as the search key for the 

receiving-side VPN-ID. Further, the receipt port and 
other information can be also used as a search key. 
[0032] On the other hand, in case the PM functions 

as the transmitting-side PM, the L2 processing unit 

25 searches, from the search table, for a corresponding 
piece of L2 header information, with the search key 
being L2 header information received from the L3 
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processing unit. The L2 header is created based on the 
L2 header information searched for and added to the 
packet, and it is forwarded to a transmission port 
corresponding to a destination of the packet. 
5 [0033] The L3 processing unit has substantially 

the same composition as the L2 processing unit. The L3 
processing unit includes an NP 15 as a packet analyzing 
unit, a search engine (SE) 16 as a search unit, and a 
CAM 17 and a SRAM 18 as a routing table. The CAM 17 and 

10 the SRAM 18 construct a CAM device. 

[0034] The L3 processing unit has substantially 

the same function as the L2 processing unit. The NP 15 
analyzes the packet, and transfers search information 
obtained by the analysis to the SE 16. The SE 16 

15 generates a CAM access key (a search key) on the basis 
of the search information from the NP 15, and makes a 
search of the CAM 17 by using the CAM access key. The 
SE 16 receives an address of the SRAM 18 from the CAM 
17 as a search result. The SE 16 accesses the SRAM 18 

20 by use of the SRAM address, and receives associative 

data (desired data) corresponding to the SRAM address. 
The SE 16 transfers the associative data to the NP 15. 
[0035] In case the PM functions as the receiving- 

side PM, the L3 processing unit searches, from the 

25 search table, for the corresponding transmitting-side 
PM and transmitting-side VPN identifying information 
(the transmitting-side VPN-ID) , with the search key 
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being a receiving-side VPN-ID received from the L2 
processing unit (the NP 11) and being an IP destination 
address (IPDA) of the packet that is obtained by 
analysis of the packet. The transmitting-side VPN-ID 
5 searched for is forwarded to the corresponding 
transmitting-side PM via the SW 2 . 

[0036] On the other hand, in case the PM functions 

as the transmitting-side PM, the L3 processing unit 
searches, from the search table, for corresponding 

10 pieces of identifying information (an ID or a number) 

of a transmission port and of L2 header information ID, 
with the search key being a transmitting-side VPN-ID 
received from the L3 processing unit of the receiving- 
side PM and being an IPDA of the packet, and transfers 

15 them to the L2 processing unit. 

[0037] FIG. 3A is a diagram showing examples of 

data structures in the CAM 13 and in the SRAM 14 shown 
in FIG. 2, and FIG. 3B is a diagram showing examples of 
data structures in the CAM 17 and in the SRAM 18 shown 

20 in FIG. 2. 

[0038] As shown in FIG. 3A, the CAM 13 is stored 

with one or more entries including the SRAM address 
corresponding to the receipt port identifying 
information or the L2 header information ID as a CAM 

25 access key. On the other hand, the SRAM 14 is stored 
with one or more entries including the receiving-side 
VPN-ID and the L2 header information as pieces of 
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associative data. 

[0039] Further, as shown in FIG. 3B, the CAM 17 is 

stored with one or more entries including the SRAM 
address corresponding to the receiving- or 
5 transmitting-side VPN-ID and the IPDA as the CAM access 
key. On the other hand, the SRAM 18 is stored with one 
or more entries including transmission PM identifying 
information (e.g. a blade number) as pieces of 
associative data, transmission port identifying 

10 information (e.g. a port number), a transmitting-side 
VPN-ID and L2 header information ID. 
[0040] <Process by PM> 

FIG. 4 is a flowchart showing a process (a VPN 
translation) by the receiving-side PM and the 

15 transmitting-side PM. In FIG. 4, when the receiving- 
side PM receives the packet (step SOI) , the NP 11 
acquires the receiving-side VPN-ID on the basis of the 
receipt port as an L2 terminating process (step S02) . 
Namely, the NP 11 of the L2 processing unit analyzes 

2 0 the packet and transfers the search information 

including receipt port identifying information (e.g. a 
receipt port number) to the SE 12. The SE 12 extracts 
the receipt port number from the search information, 
inputs this as a CAM access key to the CAM 13 , and 

25 receives an SRAM address corresponding thereto from the 
CAM 13. The SE 12 reads, from the SRAM 14, a 
receiving- side VPN- ID stored in an SRAM address and 
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transfers it to the NP 11. The NP 11 transfers the 
packet and the receiving-side VPN-ID to the NP 15 of 
the L3 processing unit. 

[0041] Upon finishing step S02 , the L3 processing 

5 unit performs a routing search by using the receiving- 
side VPN-ID and the IPDA as an L3 routing process (step 
S03) . Namely, the NP 15 of the L3 processing unit 
analyzes the received packet, and transfers the search 
information including the receiving-side VPN-ID and the 

10 IPDA of the packet to the SE 16. The SE 16 extracts 

the receiving-side VPN-ID and the IPDA from the search 
information, inputs them as a CAM access key to the CAM 
17, and receives an SRAM address corresponding thereto 
from the CAM 17. The SE 16 reads, from the SRAM 18, 

15 transmitting-side PM identifying information (e.g. a 
blade number) and a transmitting-side VPN-ID that are 
stored in the SRAM address. 

[0-042] The transmitting PM identifying information 

and the transmitting-side VPN-ID, which have been 
20 acquired by the SE 16, are transferred as a search 
result to the NP 15 (step S04) . 

[0043] Then, the NP 15 judges whether it is a VPN 

translation target or not (step SOS). Namely, the NP 
15 judges whether or not the receiving-side VPN-ID is 
25 different from the transmitting-side VPN-ID. At this 
time, if the VPN-IDs are different from each other 
(SOS: YES), the processing proceeds to step S06, and, 
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whereas if not (SOS; NO), the processing proceeds to 
step S07. 

[0044] In case the processing proceeds to step S06, 

the NP 15 executes a VPN-ID translation process. That 
5 is, the NP 15 translates a value of the receiving-side 
VPN-ID into a value of the transmitting-side VPN-ID. 
Thereafter, the processing proceeds to step S07 . 
[0045] In case the processing proceeds to step S07 , 

the NP 15 forwards the packet and the transmitting-side 

10 VPN-ID to the transmitting-side PM searched for. 

[0046] Herein, the process in step S06 implies a 

process of translating the value of the transmission 
target VPN-ID into the value of the transmitting-side 
VPN-ID. According to this, even in the case of such a 

15 composition (a conventional composition) that the 

receiving-side PM forwards the receiving-side VPN-ID to 
the transmitting-side PM, the transmitting-side VPN-ID 
searched for can be forwarded to the transmitting-side 
PM. On the other hand, in case the receiving-side VPN- 

20 ID is equal to the transmitting-side VPN-ID, the 

receiving-side VPN-ID is forwarded to the transmitting- 
side PM, whereby it follows that the transmitting VPN- 
ID is to be forwarded. Thus, the present invention can 
be actualized by improving the entry structure in the 

25 routing table and inserting steps SOS and S06 into the 
conventional processing steps. The invention may, 
however, be configured so that a VPN-ID having the 
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equal value to the transmitting-side VPN-ID retrieved 
from the routing table of the receiving-side PM is 
forwarded as the search key to the transmitting-side PM , 
and may also be configured so that the transmitting- 
5 side VPN-ID searched for is forwarded to the 
transmitting-side PM . 

[0047] The packet and the transmitting-side VPN-ID 

sent from the receiving-side PM arrive, based on the 
transmitting-side PM identifying information searched 
10 for, at the corresponding transmitting-side PM via the 
SW 2 (step S08) . 

[0048] Then, the L3 processing unit of the 

transmitting-side PM executes, as the L3 routing 
process, a routing search based on the transmitting- 

15 side VPN-ID and the IPDA (step S09) . Namely, the NP 15 
of the transmitting-side PM analyzes the packet, and 
transfers the search information including the 
transmitting-side VPN-ID and the IPDA to the SE 16. 
The SE 16 extracts the transmitting-side VPN-ID and the 

20 IPDA from the search information, inputs them as the 
CAM access key to the CAM 17, and receives the SRAM 
address corresponding thereto from the CAM 17. The SE 
16 accesses the SRAM 18, and reads the transmission 
port identifying information (e.g. the transmission 

25 port number) and the L2 header information ID that are 
stored in the SRAM address. 

[0049] The transmission port number and the L2 
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header information ID acquired by the SE 16 are 
transferred as a search result to the NP 15 (step S10) . 
The NP 15 transfers the search result together with the 
packet to the L2 processing unit. 
5 [0050] The L2 processing unit executes an L2 

termination process (step Sll) . Namely, the NP 11 
transfers the L2 header information ID to the SE 12. 
The SE 12 inputs the L2 header information ID as the 
CAM access key to the CAM 13, acquires a SRAM address 

10 corresponding thereto, acquires from the SRAM 14 the L2 
header information stored in the SRAM address, and 
transfers it to the NP 11. The NP 11 generates a L2 
header based on the L2 header information and adds the 
L2 header to the packet. 

15 [0051] Then, the NP 11 forwards the packet to the 

transmission port corresponding to the transmission 
port number searched for (step S12) . 

[0052] In the router 1, the routing entries (the 

entries for the networks) for searching for the network 

20 address as shown in FIG. 1 and the routing entries (the 
entries for the terminals) for searching the terminals, 
are registered in the routing table (the CAM 17 and the 
SRAM 18) with respect to each of PMO , PM1 and PM2 . 
[0053] Herein, as described above, the receiving- 

25 side PM searches for the transmitting-side PM by use of 
the receiving-side VPN-ID, and the transmitting-side PM 
searches for the transmission port corresponding to the 
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destination of the packet by use of the transmitting- 
side VPN-ID. This enables, though the VPN (the 
transmitting-side VPN-ID) to which the destination of 
the packet belongs is the same, even in the case where 
5 the VPN (the receiving-side VPN-ID) to which the 
transmission source belongs is different, the 
transmitting-side PM to perform the routing search by 
use of the same entries. 

[0054] In particular, the router 1 has the 

10 plurality of terminals belonging to the same VPN. 
Therefore, the router 1 is constructed so as to 
determine the transmission port by identifying the 
terminal corresponding to the destination of the packet 
(the routing table for the terminals (the entries for 

15 the terminals) is prepared). Therefore, the access- 
side PM (PM1, PM2) functioning as the transmitting-side 
PM determines the transmission port by identifying the 
VPN to which the terminal belongs and the terminal 
(i.e., the IPDA (the destination address) of the 

20 packet) . At this time, the access-side PM, because of 
using the transmitting-side VPN-ID, even when the 
transmission source of the forwarding target packet 
belongs to any one of the VPN-A, VPN-B , VPN-C and VPN-D, 
can determine the transmission port by use of the same 

25 entries. 

[0055] Thus, in the embodiment, there is no 

necessity of preparing the entries for every receiving- 
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side VPN-ID and every host address in order to identify 
the terminal in the router 1. Accordingly, the number 
of the CAM entries can be* reduced, and the entry 
registration in the CAM can be efficiently conducted. 
5 [0056] Note that the SE 16 of each PM is 

constructed so as to, in the routing search, generate a 
combination (which is a CAM access key to the entries 
for the networks) of the VPN-ID and the network address 
and a combination (which is a CAM access key to the 

10 entries for the terminals) of the VPN-ID and the host 

address, and to input them to the CAM 17. With respect 
to a packet flow of the access side -> the up-link side, 
however, each of the receiving-side and transmitting- 
side PMs may be constructed so as to generate only the 

15 CAM access key to the entries for the networks. 

Further, with respect to the packet flow of the up-link 
side -> the access side, the receiving-side PM may be 
constructed so as to generate only the CAM access key 
to the network entries, and the transmitting-side PM 

20 may also be constructed so as to generate only the CAM 
access key to the entries for the terminals. 
[0057] <Entry Registration> 

Next, a process on the occasion of registering 
routing entries (which will hereinafter be simply 

25 termed "entries") will be explained. As shown in FIG. 
1, in the case of registering the entries in the 
routing table, there is constructed so that a plurality 
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of entries as candidates for registration are 
distributed to each PM by a registration command from a 
main processor (MP) connected to the router 1. 
[0058] To explain it concretely, the MP gives the 

5 router 1 the plurality of entries as the candidates for 
registration that should be registered in the CAM 17 
and the SRAM 18 (i.e., a CAM device, namely the routing 
table), as shown in FIG. 1, of each PM . The plurality 
of entries given to the router 1 are given respectively 

10 to a CAM driver (corresponding to entry registration 

means) provided per PM in the router 1, and written to 
(registered in) the corresponding CAM 17 and SRAM 18. 
[0059] Herein, the plurality of entries includes 

the entries for the networks and the entries for the 

15 terminals. Each entry for the networks includes, as 

shown in FIG. 1, a receiving-side or transmitting-side 
VPN-ID and a network address as pieces of CAM entry 
information (a CAM access key), and includes, as pieces 
of SRAM associative data information, transmitting-side 

20 PM identifying information (e.g. a blade number), a 

transmission (output) port number and a transmitting- 
side VPN-ID. 

[0060] On the other hand, each entry for the 

terminals includes a receiving-side or transmitting- 
25 side VPN-ID and a host address of the terminal as 
pieces of CAM entry information, and includes 
transmitting-side PM identifying information (e.g. a 
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blade number) , a transmission port number and a 
transmitting-side VPN-ID as pieces of SRAM associative 
data information. Note that the L2 header information 
ID is omitted in FIG. 1. Namely, the L2 header 
5 information ID is not an indispensable piece of 
information element for the invention. 
[0061] Herein, the plurality of entries as the 

candidates for registration are entries with respect to 
all combinations of the VPN-ID, the network address and 

10 the host address of the terminal in connection with the 
routing process of the router 1, and the entries for 
the terminals includes one or more overlapped entries 
(see FIG. 1) . Then, the CAM driver of each PM executes 
an entry delete process, thereby deleting one or more 

15 unnecessary (registered but non-used) entries. 

[0062] FIG. 5 shows a flowchart of the entry 

delete process. Each CAM driver 3 executes the entry 
delete process for every entry in a way that sets all 
the entries related to the registration command as 

20 processing targets. 

[0063] At first, the CAM driver 3 judges whether a 

processing target entry is the entry for the terminals 
or not (step S101) . At this time, if the entry is not 
the entry for the terminals (but the entry for the 

25 networks) (S101; NO), the CAM driver 3 registers this 

entry as a registration target in the CAM 17 and in the 
SRAM 18 . 
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[0064] Whereas if the entry is the entry for the 

terminals (S101; YES), the CAM driver 3 refers to the 
blade number contained in this entry and judges whether 
this blade number is a self-blade number or not (step 
5 S102) . The CAM driver 3 previously knows the blade 
number of the PM corresponding to the driver itself. 
Herein, if the blade number is not the self-blade 
number (S102; NO), the CAM driver 3 sets this entry as 
a delete target and performs no registration 

10 (discarding) of this entry. 

[0065] Whereas if the blade number is the self- 

blade number (S102; YES), the CAM driver 3 judges 
whether or not the entry is a translation target, 
namely, judges whether the receiving VPN-ID (the VPN-ID 

15 contained in the CAM entry information) and the 

transmitting VPN-ID, which are contained in the entry, 
are equal or not (step S103) . 

[0066] At this time, if the VPN-IDs are different 

from each other (S103; NO), the CAM driver 3 sets this 
20 entry as a delete target and performs no registration 
(discarding) of this entry. 

[0067] Whereas if the VPN-IDs are equal to each 

other (S103; YES), the CAM driver 3 sets this entry as 
a registration target and registers this entry in the 
25 CAM 17 and in the SRAM 18. 

[0068] Each CAM driver 3 corresponding to each of 

the PMs (PM0 - PM2) individually effects the entry 
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delete process. The entry for the terminals, which is 
not used in each of the PMO - PM2 , is thereby, as shown 
in FIG. 6, deleted from the plurality of entries based 
on the registration command from the MP. 
5 [0069] A state in an example shown in FIGs . 6A and 

6B are that among the plurality of PMs , the entries for 
the terminals are registered in only in the routing 
table of the access-side PM accommodating at least one 
of terminal, the routing table of each access-side PM 
10 is registered with only the entries for the terminals 
related to the VPN to which the terminals accommodated 
in the access-side PM. 

[0070] Accordingly, the number of the registration 

entries can be reduced, an effective utilization of a 
15 storage space of the CAM device can be made. Note that 
the CAM driver 3 may delete the entries, which have 
been temporarily registered in the CAM and the SRAM, 
from the CAM and the SRAM by the above-mentioned 
process . 

20 [0071] According to the embodiment, it is possible 

to delete the overlapped entry and the unused entry 
among the entries for the terminals of the BRAS 
performing the inter-VPN communications, and hence, 
even in a case where there increase the common servers 

25 such as the content servers for services as the BRAS, 
the overlapped entry is not required to be registered, 
and the efficient entry registration by the CAM device ' 
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becomes possible. Further, the system enables a 
deletion of the entry for performing the inter-VPN 
communications in normal packet forwarding routing 
entries as well as in the entries of the BRAS, whereby 
5 the efficient entry becomes possible. 

[0072] According to the invention, the overlapped 

entry does not need to be registered, and the efficient 
entry registration becomes possible. 
[0073] The invention may be embodied in other 

10 specific forms without departing from the spirit or 
essential characteristics thereof. The present 
embodiment is therefore to be considered in all 
respects as illustrative and not restrictive, the scope 
of the invention being indicated by the appended claims 

15 rather than by the foregoing description and all 

changes which come within the meaning and range of 
equivalency of the claims are therefore intended to be 
embraced therein. 



